42
QubesOS workstation + homeserver, and DANE for TLS without 3rd party company (neowutran.ovh)
submitted 1 day ago by to c/selfhosted@lemmy.world
12 comments fedilink hide all child comments
 

2.5 years ago, I migrated all my services hosted on a cloud provider to a homeserver.

This homeserver is also my workstation/gaming/dev/everything. I use QubesOS (an operating system based on the Xen hypervisor), and wrote some document about it: https://neowutran.ovh/qubes/articles/homeserver.pdf

Basically, I am hosting:

  • DNS
  • Matrix
  • Email
  • Jitsi
  • Mumble
  • Peertube
  • Screego
  • Nextcloud
  • Searxng
  • Tor
  • Wireguard VPN
  • Copy of wikipedia
  • Personal website And others.

And for TLS, to have better security, and to avoid relying on third party company/providers, I am using DANE.

https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities

https://sr.ht/~yukikoo/dane_without_root/

https://github.com/buffrr/letsdane

The "dane_without_root" is one of my projects and I am welcoming review / feedback on it

( I also posted about it on the QubesOS forum: https://forum.qubes-os.org/t/highlighting-neowutrans-technical-doc-about-qubes )

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 hours ago*

If you're just pushing for WebPKI without "thinking too hard" about perpretrating a security system with a large number of failure points, then you're following that windows method.

SSL/TLS have very specific benefits. None of which matter that much for reading random articles on the web. So I don't see the problem with this website doing their own thing to bring attention to the potential issues of the current system.

  • permalink
  • fedilink
  • source
  • parent